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CROSS-REFERENCE TO RELATED APPLICATIONS 

[001] This application is based upon and claims the benefit of priority from 
the prior Japanese Patent Applications No. 2002-264977, filed September 11, 2002 
the entire contents of which are incorporated herein by reference. 

BACKGROUND OF THE INVENTION 
Field of the Invention 

[002] The present invention relates to an encryption apparatus and method 
provided with a Feistel type algorithm, and more particularly, to an encryption 
apparatus and method resistant to a differential power analysis attack. 
Description of the Related Art 

[003] In a conventional differential power analysis ("DP A") attack, an 
attacker produces a graph related to power consumption during an encryption 
operation of an encryption operation circuit. Using the power consumption graph, the 
attacker can steal key information stored in the encryption operation circuit. 

[004] Li an DPA attack, an attacker inputs a plurality of pieces of data into 
an encryption operation circuit and obtains measurements of the corresponding power 
consumption of the encryption operation circuit. Next, the attacker estimates the key 
information stored in the encryption operation circuit. At this time, if a correlation 
value between the estimated key information and the power consumption is large, then 
the estimated key information is correct, otherwise the estimated key information is 
incorrect. In other words, the DPA attack uses a principle of correlation between the 
estimated key information and the power consumption of the encryption operation 
circuit. 

[005] In the event of a DPA attack, users of the encryption operation circuit 
cannot determine, by inspecting the physical appearance of the circuit, whether or not 



1 



the key information has been stolen by the DPA attack because the DPA attack does 
not damage or destroy the encryption operation circuit. Therefore, potential damage 
from the DPA attack is greater than from other types of attacks because the attack is 
harder to detect. Accordingly, a countermeasure to the DPA attack is important in 
protecting an encryption operation circuit. 

[006] Most common key block cryptosystems, for example smart cards and 
secure tokens, employ a Feistel type encryption algorithm which was developed by 
Horst Feistel. Japanese Patent Laid-Open No. 2000-66585 discloses a 
countermeasure to the DPA attack for an encryption operation circuit utilizing the 
Feistel type encryption algorithm. More particularly, Japanese Patent Laid-Open No. 
2000-66585 discloses that the key information is masked during an operation using the 
key information so that there is no correlation between the power consumption during 
the operation using the key information and the key information. This technique 
disclosed in Japanese Patent Laid-Open No. 2000-66585 is an effective 
countermeasure to a DPA attack occurring at the end of an operation, but is not the 
effective countermeasure to a DPA attack occurring after the end of the operation. 
BRIEF SUMMARY OF THE INVENTION 

[007] According to an aspect related to the present invention, an encryption 
apparatus includes an encryption operation unit configured to perform a non-linear 
function, said encryption operation unit being provided with a Feistel type encryption 
algorithm and configured to output encrypted data; and a changing unit configured to 
change a result of an encryption operation into irrelevant data for output to the 
non-linear function, wherein said changing unit starts changing the result into said 
irrelevant data after said encrypted data is output. 
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[008] According to another aspect related to the present invention, An 
encryption apparatus includes an encryption processing unit configured to iterate a 
specified operation in order to encrypt data and to externally output the encrypted 
data, said encryption processing unit, including: a non-linear transformation circuit 
configured to non-linearly transform an input first data block based on input key 
information and configured to output the non-linearly transformed result value, a 
logical operation circuit configured to logically operate on the non-linearly 
transformed result value and an input second data block and configured to output the 
logical operated resuh value, and a substitution module configured to substitute said 
second data block with said first data block and said first data block v^ith the logical 
operated result value; and a changing module configured to change said key 
information input into said non-linear transformation circuit into a value unrelated to 
said key information, wherein said changing module begins execution after said 
encrypted data is output fi-om said encryption processing unit. 

[009] According to another aspect related to the present invention, an 
encryption apparatus includes an encryption processing unit configured to iterate a 
specified operation in order to encrypt data and to externally output the encrypted 
data, said encryption processing unit, including: a non-linear transformation circuit 
configured to non-linearly transform an input first data block based on input key 
information and configured to output the non-linearly transformed result value, a 
logical operation circuit configured to logically operate the non-linearly transformed 
result value and an input second data block and configured to output the logical 
operated result value, and a substitution module configured to substitute said second 
data block with said first data block and said first data block with the logical 
operated result value; and a first changing unit configured to change said first data 
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block input into said non-linear transformation circuit into a value unrelated to said 
first data block, wherein said first changing unit begins execution after said 
encrypted data is output from said encryption processing unit. 

[010] According to another aspect related to the present invention, an 
encryption apparatus provided v^ith a Feistel type encryption algorithm including a 
non-linear transformation includes a register configured to store data in the 
encryption apparatus; and a changing unit configured to change a data block to be 
applied to said non-linear transformation into a value unrelated to the data block in 
order to supply the register with information unrelated to an encryption process, 
wherein said changing unit begins execution after said encrypted data is output. 

[Oil] According to another aspect related to the present invention, an 
encryption apparatus provided with a Feistel type encryption algorithm including a 
non-linear transformation includes a register storing data in the encryption apparatus; 
and a changing unit configured to change key information to be applied to said 
non-linear transformation into a value unrelated to the key information in order to 
supply the register with information unrelated to an encryption processing, wherein 
said changing unit begins execution after said encrypted data is output. 

[012] According to another aspect related to the present invention, a 
method for encrypting data in an encryption apparatus utilizing a Feistel type 
encryption algorithm includes receiving data to be encrypted; performing an 
encryption operation on the received data to produce encrypted data; outputting the 
encrypted data; changing the encrypted data into irrelevant data; and performing a 
non-linear operation on the irrelevant data. 

[013] Additional advantages of the invention will be set forth in part in the 
description which follows, and in part will be obvious from the description, or may 
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be learned by practice of the invention. The advantages of the invention will be 
realized and attained by means of the elements and combinations particularly pointed 
out in the appended claims. 

[014] It is to be understood that both the foregoing general description and 
the following detailed description are exemplary and explanatory only and are not 
restrictive of the invention, as claimed. 

[015] The accompanying drawings, which are incorporated in and 
constitute a part of this specification, illustrate several aspect related to the invention 
and together with the description, serve to explain the principles of the invention. 
BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
[016] Fig. 1 is a flowchart illustrating processing by a Feistel type 
encryption algorithm in an encryption operation circuit; 

[017] Fig. 2 is a diagram of a circuit configuration for a data path portion 
in an encryption operation circuit provided with a Feistel type algorithm; 

[018] Fig. 3 is a diagram of a data path portion in a cross-type circuit 
configuration for the encryption operation circuit shown in Fig. 2; 

[019] Fig. 4 is a diagram showing a data path in a straight-type circuit 
configuration for the encryption operation circuit shown in Fig. 2; and 

[020] Figs. 5 to 12 are diagrams of exemplary configurations of an 
encryption operation circuit including a countermeasure against a DPA attack 
consistent with aspects related to the present invention. 

DETAILED DESCRIPTIONS OF THE INVENTION 
[021] Reference will now be made in detail to aspects related to the present 
invention, examples of which are illustrated in the accompanying drawings. 
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Wherever possible, the same reference numbers will be used throughout the drawings 
to refer to the same or like parts. 

[022] Fig. 1 is a flowchart illustrating of the flow of processing by a Feistel 
type encryption algorithm in an encryption operation circuit. First, the encryption 
operation circuit subjects an input block data to be encrypted to an Initial 
Permutation ("IP"). The IP rearranges data among input block data bits (stage 100). 
Then, the encryption operation circuit divides the block data after the initial 
permutation into two blocks each having n/2 bits (stage 102). Next, using these two 
blocks as initial values, the encryption operation circuit iterates the following 
operation (stage 104). 

Li=Ri.i 

Ri=Li_i0F(keyi,Ri_i) 

where i is the number of operations (l<i<k), Ri is the right block data in the i-th 
operation, Li is the left block data in the i-th operation, keyi is the i-th key information, 
F is a function for carrying out a non-linear operation, and ® is an exclusive OR 
(XOR). 

[023] After the iteration operation (stage 106) is iterated k times, the 
encryption operation circuit combines the results of the operations Rk and Lk (stage 
108). Specifically, the encryption operation circuit combines Lk as the block of the 
higher order n/2 bits and Rk as the block of the lower order n/2 bits into n-bit block 
data. 
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[024] Finally, the encryption operation circuit subjects the combined block 
data to an inverse initial permutation ("IP"*"), and the result is obtained and the 
operation ends (stage 110). 

[025] Fig. 2 is a block diagram of the configuration of a data path portion 
in an encryption operation circuit 200 provided with a Feistel type encryption 
algorithm. Encryption operation circuit 200 includes an IP unit 204, an R register 
206, an L register 208, a function operation unit 210, an IP"* unit 212, 
3-input-l -output selectors 214 and 216, and data paths 236 and 238. 

[026] IP unit 204 is a circuit module that carries out an initial permutation 
operation on an input 202 based on predetermined rules. Function operation unit 
210 is a circuit module that carries out the operation of a prescribed non-linear 
function F. BP'* unit 212 is a circuit module that carries out an inverse initial 
permutation operation based on rules reciprocal to the predetermined rules utilized 
by IP unit 204. L register 208 and R register 206 each have an n/2 bit width. 
3-input-l -output selectors 214 and 216 respond to a signal from a control circuit unit 
(not shown) and select data to be input to L register 208 and R register 206. The 
three inputs (222, 224, and 226) to selector 214 are the value of the higher order n/2 
bits from the IP unit 204, the output value of R register 206, and a value produced by 
XORing the output value of L register 208 and the output value of function operation 
unit 210. Meanwhile, the three inputs (228, 230, and 232) to selector 216 are the 
value of the lower order n/2 bits from IP unit 204, the output value of R register 206, 
and a value produced by XORing the output value of L register 208 and the output 
value of fiinction operation unit 210. After all iterations are finished, encryption 
operation circuit 200 produces an output 220. 
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[027] The result of the encryption operation processed in the above 
described configuration is C =(Ci, Cr) and can be expressed as follows: 

C=IP-^ {(U®F(keyu, Rk)),Rk}. 

[028] In encryption operation circuit 200, IP"^ unit 212 only changes the 
arrangement of bits, and therefore the value of Rk can readily be specified from the 
operation result C. Once the value Rk is specified, the output value of function 
operation unit 210 after the operation is determined only by the value of one variable 
in the key information, keyk. Consequently, using the output result from function 
operation unit 210 as an attacking point, the key information keyk can be estimated 
and a DPA attack can be performed. 

[029] If there is a correlation between fluctuations in the power 
consumption and the operation of the key information by function operation unit 210, 
the attacker can determine the key information. More particularly, the attacker 
carries out a DPA attack the moment when an encryption operation ends and steals 
the key information in the encryption operation circuit. This kind of DPA attacks 
can be prevented, for example, by the technique described in Japanese Patent 
Laid-Open No. 2000-66585. 

[030] An encryption operation circuit provided with a Feistel type 
encryption algorithm can be subjected to an attack at any point after the end of an 
encryption operation (the time after the end of the operation and onward) in addition 
to the moment when the encryption operation ends, and the key information in the 
encryption operation circuit can be stolen by the DPA attack. Data may be 
controlled in the data path portion at the time of outputting an operation result from 
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the encryption operation circuit by two different methods. The DPA attacking 
points after the encryption operation differ depending on the method by which the 
data is controlled. 

[031] Fig. 3 is a diagram of a data path portion in a cross-type circuit 
configuration for the encryption operation circuit shown in Fig. 2. According this 
configuration, selector 216 selects a data path 302, and selector 214 selects a data 
path 304 at the time of outputting an operation result. In this configuration, the data 
of L register 208 and R register 206 are exchanged and the operation ends. In other 
words, encryption operation circuit 200 employs a cross type circuit configuration. 

[032] Fig. 4 is a diagram showing a data path in a straight-type circuit 
configuration for the encryption operation circuit shown in Fig. 2. According to this 
configuration, selector 216 selects data path 404 and selector 214 selects data path 
402 at the time of outputting an operation result. In this configuration, the data of L 
register 208 and R register 206 are not exchanged and the operation ends. In other 
words, encryption operation circuit 200 employs a straight-type circuit configuration. 

[033] In an encryption operation circuit 200 provided with a Feistel type 
encryption algorithm, in order to carry out the iteration operation determined by the 
algorithm, a control circuit (not shown) controls selectors 214 and 216 so that the left 
and right data are exchanged. In encryption operation circuit 200, when an 
operation result is output, the operation is controlled to end in the cross-type circuit 
configuration having the left and right data exchanged, unless it is particularly 
necessary to do otherwise. The cross-type circuit configuration is employed because 
the control of exchanging the left and right data similar to the iteration operation is 
easily carried out and the scale of the circuit can be small rather than the control of 
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changing the data flow in the time of outputting the operation result even when the 
operation result is output. 

[034] Additionally, in a circuit provided with Triple Data Encryption 
Standard (Triple DES or 3DES) which carries out DES three times, a control circuit 
must prevent left and right data from being exchanged between the end of the first 
DES operation and the start of the second DES operation and between the end of the 
second DES operation and the start of the third DES operation. Therefore, after the 
third DES operation, the straight type circuit configuration is often employed so that 
the left and right data are not exchanged before output. The control circuit avoids 
switching between the cases during an operation as much as possible in order to 
reduce the circuit scale. Selectors 214 and 216 are controlled to have the straight 
type circuit configuration at the end of the third operation as well as at the end of the 
first and second operations, so that the number of switches between operation can be 
reduced and the scale of the control circuit can be reduced. 

[035] As described above, when a Feistel type encryption algorithm is 
provided, an encryption operation circuit employs the cross or straight-type circuit 
configuration. 

[036] Now, the difference between the attacking points by a DPA attack 
after the end of an operation depending upon the difference between these circuit 
configurations will be described. First, the timing of attacking points by a DPA 
attack and the reason for the cross type circuit configuration will be described with 
reference to Fig. 3. 

[037] At a time of a clock signal Clockfin for outputting an operation result, 
the value of L register 208 is Lf,n, and the value of R register 206 is Rf,n. At this 
time, if the result of operation by the encryption operation circuit is C, C can be 
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expressed using the result of L register 208 encryption operation, Ci, and the resuh of 
R register 206 encryption operation, Cr, as follows: 

C= TP-\Cu Cr)= IP-\Lfin®F(keyfin, Rfm), Rfm) 

where IP"* is a processing for changing the arrangement of bits in the inverse initial 
permutation. Therefore, the values of Rfm and Lfin®F(keyfin, Rfm) are readily 
available from the operation result C. 

[038] Now, when the clock signal is Clockfm+i, if R register 206 can be 
written with a value, the value of R register 206 is Lfin®F(keyfin, Rfm)==Rfin+i. At this 
time, the key information is same as keyfm at the Clockfm. Therefore, the output of 
function operation unit 210 is F(keyfm, Rfm+i). The value Rfm+i is readily 
determinable from the output result of the encryption operation circuit, and therefore 
the function F by the function operation unit 210 can be regarded as a function with 
keyfin as a single variable. 

[039] In this manner, using the transition in the output of function 
operation unit 210 as an attacking point, an attacker estimates the output of function 
operation unit 210. From this, the key information is determined. 

[040] Altemately, the transition in the value of L register 208 can also be 
used as an attacking point. The values of L register 208 in the times of Clockfin and 
Clockfin+i are Lfm and Lf,n+i, respectively. The transition in the value of the L 
register 208 can be expressed as follows: 

Lfm®Lfin+ 1 =Rfin- 1 ® Rfin 



11 



[041] The right side of the above expression is rewritten based on that the 
value of L register 208 in the cross-type circuit configuration that satisfies the 
relation Li=Ri.i (l<i<k). Here, Rfin is a value that can externally be measured. 
Therefore, Rfm-i can be estimated. The transition in L register 208 is related to the 
fluctuations in the power consumption of encryption operation circuit 200, and 
therefore the value of Rr,n-i can be specified by a DPA attack. More specifically, as 
described above, based on the operation result C, the values of Lfin®F(keyfin, 
Rfin)=Rfin+i and Rfm can be measured. Here, since Lfin=Rfin.i, once Rf,n-i is specified, 
Rfin+i, Lfin, and R^n are available, so that keyrm can be determined. 

[042] As described above, during the transition in the output value of 
function operation unit 210 or the transition in the value of L register 208, an 
attacker can carry out a DPA attacks with success. 

[043] In the cross-type circuit configuration, various countermeasures can 
be taken to prevent such DPA attacks as will be described with reference to Figs. 
5-10. 

[044] As a countermeasure against a DPA attack related to the output value 
of function operation unit 210 at the time of Clockfin+i in the cross-type circuit 
configuration, the encryption operation circuit 200 configuration is adapted so that a 
value input to function operation unit at the time of Clockf,n+i is a value irrelevant to 
the key information. Fig. 5 is a block diagram illustrating an example of this 
adaptation of encryption operation circuit 200. As shown in Fig. 5, an additional 
selector 502 is provided in a location for inputting key information to function 
operation unit 210. The key information, key, is input until the time of Clocknn, 
and, then, in and after the time of Clockfin+i, a random number, RN, may be input. 
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[045] Alternatively, Fig. 6 is a block diagram illustrating an example of an 
adaptation to encryption operation circuit 200 including a logical operation circuit 
602. As shown in Fig. 6, a value produced by an exclusive OR ("XOR") operation, 
a logical multiplication ("AND") operation, or a logical addition ("OR") operation 
between the key information, key, and a random number, RN, may be input into 
function operation unit 210 At the times in and after Clockf,n+i, an operation result 
produced by applying a different random number, RN, at each clock cycle is input. 
In this way, the above problems are solved. 

[046] Another encryption operation circuit configuration that prevents an 
externally measurable value from being input to function operation unit 210 can also 
be an effective countermeasure. Fig. 7 is a block diagram illustrating an example 
this configuration of encryption operation circuit 200. As shown in Fig. 7, a selector 
702 is provided preceding the input of function operation unit 210, and random 
numbers, RN, can be input instead of the content of R register 206 in and after the 
time of Clockfin+i. 

[047] Alternatively, Fig. 8 is a block diagram illustrating an example of 
another configuration of encryption operation circuit 200. As shown in Fig. 8, in 
place of selector 702, encryption operation circuit 200 can include an additional 
operation circuit 802. The result of an operation between the value of R register 206 
and a random number, RN, can be input into function operation unit 210. These 
encryption operation circuit configurations prevent key information used in the 
encryption operation circuit or an operation result from being directly input to 
function operation unit 210 in and after the time of Clockfm+i. This can thwart DP A 
attacks in relation with the output of function operation unit 210. 
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[048] In addition, setting the value of R register 206 as an irrelevant value 
for the result of operation in and after Clockfm can work as a countermeasure against 
DP A attacks. The reason for using Clockfin not Clockfin+i depends on the layout of 
the circuits. Fig. 9 is a block diagram illustrating an example of this configuration 
of encryption operation circuit 200. As shown in Fig. 9, encryption operation circuit 
200 can include a selector 902 that precedes the input of R register 206, so that a 
random number, RN, is written in R register 206 from selector 902 in and after the 
time of Clockfin+i. 

[049] Ahematively, Fig. 10 is a block diagram illustrating another example 
of this configuration of encryption operation circuit 200. As shown in Fig. 10, the 
result of data path 236 and a random number, RN, may be subjected to a logical 
operation performed by a logical operation circuit 1002. The encryption operation 
circuit provided with the above-described countermeasure prevents an attacker from 
attacking using the transition in the output of function operation unit 210 as an 
attacking point in a DPA attack. 

[050] When the transition in the value of L register 208 is assumed as an 
attacking point, Rf,n should not be written in L register 208 at and after the time of 
Clockfin. Fig. 1 1 is a block diagram illustrating an example of a configuration of 
encryption operation circuit 200 to achieve this result. As shown in Fig. 1 1 , 
encryption operation circuit 200 includes an operation circuit 1 102, for example, for 
performing AND/OR/XOR operations, on a data path 238 to L register 208. The 
result of operation between the value on data path 238 and a random number can be 
written in L register 208 in and after the time of Clockfin+i. 

[051] Alternatively, Fig. 12 is a block diagram illustrating another example 
of a configuration of encryption operation circuit 200 to achieve this result. As 
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shown in Fig. 12, a selector 1202 may be provided in data path 238, so that a random 
number, RN, may be written in L register 208 in and after the time of Clockfin+i. 
The encryption operation circuit provided with these countermeasure described 
above can prevent the attacker from using the transition in the value of L register 208 
as an attacking point. 

[052] Now, the time and operation of a DPA attack in the straight type 
circuit configuration as illustrated in Fig. 4 will be described. 

[053] Similarly to the cross-type circuit configuration, in the straight type 
circuit configuration, the value of L register 208 is Lnn and the value of R register 
206 is Rfin at the time of clock signal Clock^n for outputting an operation result. At 
the time of the next clock signal Clockfin+i following Clockfin. the values of L and R 
registers 208 and 206, Lfin+i and Rfin+i, respectively, can be represented by the 
following expressions: 

Lfin+l=Lfin®F(keyfin, Rfin) 
Rfin+l=Rnn 

[054] In the time of Clockfin+i, with respect to the transition in the value of 
L register 208, the transition can be written as Lfin®Lfin+i=F(keyfin, Rfin). The 
transition F in the value of L register 208 F(keyfin, Rfm) includes information relevant 
to the key information and R^n can externally be measured. Therefore, when a DPA 
attack is carried out in relation to the transition in the value of L register 208, the key 
information, keyfm, in the encryption operation circuit can be determined. 

[055] Therefore, the circuit configuration is adapted so that the value of L 
register 208 has no correlation with the key information of the encryption operation 
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circuit at the time of Clockfin+i. Such a circuit configuration can be implemented, 
for example, by providing a logical operator circuit 1202, such as AND, OR, and 
XOR circuit, on data path 238 to L register 208 shown in Fig. 1 1 . The encryption 
operation circuit 200 functions similarly to the cross-type circuit configuration. 
Alternatively, writing the result of operation between the value of data path 238 and 
a random number, RN, in L register 208, or by switching between the value of data 
path 238 and a random number, RN, using a selector 1 102 at the time of Clockfin can 
be done, as shown in Fig. 12. 

[056] When the circuit configuration is adapted so that keyfin and R^n are 
always input to function operation unit 210 at and after the time of Clockfin, the key 
information could be specified based on the transition in the output value of function 
operation unit 210 similarly to the cross-type circuit configuration described above. 
Therefore, similar to the DPA countermeasure in function operation unit 210 for the 
cross-type circuit configuration shown in Figs. 5 to 10 can be used to implement the 
countermeasure in the straight type circuit configuration. 

[057] If data is not written in the R and L registers 206 and 208 at the time 
of Clockfin+i or Clockfin whether the circuit has the cross-type circuit configuration or 
the straight type circuit configuration, and key information keyon is always input to 
function operation unit 210 in and after Clockfin+i or Clockfin, the output value F 
(keyfin, Rfin) of function operation unit 210 results. Therefore, similar to the 
cross-type circuit configuration as described above, the transition in the output value 
of function operation unit 210 could be vulnerable to a DPA attack. Therefore, the 
DPA countermeasure in fiinction operation unit 210 for the cross type circuit 
configuration shown in Figs. 5 to 10 can be used to implement the countermeasure in 
the straight type circuit configuration. 
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[058] Additional advantages and modifications will readily occur to those 
skilled in the art. Therefore, the invention in its broader aspects is not limited to the 
specific details and representative embodiments shown and described herein. 
Accordingly, various modifications may be made without departing from the sprit or 
scope of the general inventive concept as defined by the appended claims and their 
equivalents. 
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